From 2fac7f3a74bcf76ad6253329d2ae7ebadccd4934 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 28 Jul 2021 18:19:22 +0000 Subject: [PATCH] Added detection testing service results inDetect New Open S3 Buckets over AWS CLI --- .../cloud/detect_new_open_s3_buckets_over_aws_cli.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml index 2b76f5e55c..480b108247 100644 --- a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml +++ b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml @@ -7,7 +7,8 @@ type: batch datamodel: [] description: This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. -search: '`cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp +search: '`cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* + ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control @@ -41,8 +42,8 @@ tags: impact: 60 kill_chain_phases: - Actions on Objectives - message: User $userIdentity.userName$ has created an open/public bucket $bucketName$ using AWS CLI - with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ + message: User $userIdentity.userName$ has created an open/public bucket $bucketName$ + using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$ $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$ mitre_attack_id: